WordPress maintenance plans have a bit of a reputation problem. There are a lot of them, they range from a few dollars a month to several hundred, and the descriptions on most of them are vague enough that it is genuinely hard to know what you are getting until something goes wrong and you find out the answer is not much.
I am going to tell you what a legitimate maintenance plan should cover, what the cheap ones typically skip, and what questions to ask before you sign up for one.
The Basics That Every Plan Should Cover
WordPress core updates. WordPress releases updates regularly, including security patches that are time-sensitive. A maintenance plan should include monitoring for these and applying them promptly. This is not the same as blindly auto-updating. It means someone is paying attention, checking for known compatibility issues with your specific setup, and applying the update with appropriate care.
Plugin updates. This is where most WordPress security incidents start. A plan that handles WordPress core updates but does not handle plugin updates is covering the less important of the two. Every active plugin on your site needs to be monitored and updated. That includes plugins you are not actively using but have not removed, because inactive plugins can still be exploited.
Theme updates. If you are running a commercial theme or a parent theme, updates matter. If you are on a fully custom theme, there may not be updates to apply, but the plan should account for that distinction.
Backups. A maintenance plan without a backup component is incomplete. Full stop. Updates go wrong. Edits go wrong. Sites get compromised. A clean, recent backup is what determines whether a bad situation is recoverable in an hour or recoverable never. The backup should be a full site backup, both files and database, stored somewhere other than the web server, and taken frequently enough that the maximum data loss in a worst-case scenario is acceptable to you. Daily is the standard. Nightly is better.
Post-update verification. Applying updates and walking away is not enough. After any update is applied, someone should check that the site is still functioning correctly. That means loading the homepage, checking the contact form, loading a few key pages, and verifying nothing broke. This step is what separates a maintenance plan from a script running on a cron job.
What Separates a Good Plan From a Cheap One
Backup-before-update discipline. Cheap plans run updates. Good plans run a backup first, then run updates. The difference matters enormously if an update breaks something. With a pre-update backup, you can restore in minutes. Without one, you are dealing with the broken state and hoping you can figure out what changed.
Human attention. Automated update tools are not the same as a maintenance plan. They can apply updates, but they cannot evaluate whether an update is risky for your specific configuration, notice that a plugin has been flagged with a new vulnerability, or catch that something subtle changed in the site's behavior after an update. The value of a maintenance plan is in the human judgment applied to your specific site, not in the automation.
Communication when something needs attention. A maintenance plan should include a channel for flagging things that need your attention. Not a monthly report full of green checkmarks. Actual communication when something is wrong or when a decision needs to be made. If the person maintaining your site notices something concerning, you should hear about it.
Scope clarity. What is included and what is not should be spelled out explicitly. Does the plan include content edits? What counts as a content edit versus a development task? How many hours? What happens if something breaks after an update? What is the response time? These questions have answers in a legitimate plan. They are left vague in a cheap one.
Every basic and every distinguisher, on every plan.
Backup-before-update discipline. Human attention. Real communication when something needs it. Scope you can actually read. That is what "maintenance" should mean.
What to Ask Before You Sign Up
Are updates applied manually or automatically? Manual is better because it involves human judgment. Fully automated is faster but riskier.
Is a backup taken before updates are applied? The answer should be yes, every time.
Where are backups stored? They should be offsite, not on the same server as the site.
What happens if an update breaks something? There should be a clear answer. Restore from backup, fix the conflict, whatever the process is.
What is the response time if I report a problem? You want an actual number, not "as soon as possible."
Is the person maintaining the site the same person who would fix a problem if one arose? Continuity of knowledge matters.
The Short Version
A legitimate WordPress maintenance plan covers updates, backups, post-update verification, and a channel for communication when something needs attention. It is carried out by someone who exercises judgment, not just by automation. And it includes clear answers to what happens when something goes wrong.
If you are on a plan that does not include all of the above, or if you are maintaining your own site and realizing this list is longer than you thought, our maintenance retainer plans are built around exactly these principles. No guesswork about what is covered.
